top button
Flag Notify
    Connect to us
      Site Registration

Site Registration

How to apply Open SSL openssl-1.0.1h to Apache 2.2.22

+1 vote
985 views

We have Apache 2.2.22 (Win32) on a Windows 2008 64 bit server. It currently has OpenSSL 0.9.8.

We are trying to apply the OpenSSL 1.0.1h on the same, after applying the open SSL and copying the relevant files to the bin directory of apache server, we are not able to start the server. It gives an mod_sso error.

Any Suggestions?

posted Jun 16, 2014 by Naveena Garg

Share this question
Facebook Share Button Twitter Share Button LinkedIn Share Button

1 Answer

+1 vote

Looks like you are trying to apply the patch for June 5 OpenSSL vulnerabilities for you httpd server mentioned at https://www.openssl.org/

But I think the mod_ssl shipped default by apache httpd uses the OpenSSL/0.9.8t. And hence, you might need to apply the relevant 0.9.8za available through the website...

I suspect this could be the error in your case as you are attempting for OpenSSL 1.0.1h. Please correct me if my analysis is not correct.

Further, I think the fix is about replacing the mod_ssl. So file located in the modules folder with the fixed new version of the .so file that is linked with OpenSSL 0.9.8za. I have googled and figured out that mod_ssl didnt release the new patch for this. Mostly likely, it looks like we need to rebuild mod_ssl ourselves (Just like apache httpd does !!) as mod_ssl has not released the .so file in the recent time (http://www.modssl.org/ )

answer Jun 16, 2014 by anonymous
Similar Questions
+2 votes
Apache: error mod_ssl requires OpenSSL 0.9.8a or later?

I am trying to compile httpd-2.4.7 from source, but i get the following error 

"#error mod_ssl requires OpenSSL 0.9.8a or later"

But my installed openssl version is openssl-1.0.1e and I have specified it --with-ssl option.
Any suggestions?

+1 vote
[HeartBleed] Apache and Upgrading OpenSSL

I'm working on doing some upgrade testing to mitigate the Heartbleed issue and some other vulnerabilities. Part of that is updating OpenSSL, but I'm a bit confused about something and am hoping that someone can help me. I've done at least a dozen internet searches and can't find the answer. It's probably simple, but I'd like to find out anyway.

What do I need to do in order to update the version of OpenSSL that is included in the Apache HTTP server release? I've installed OpenSSL 1.0.1g on the server, but the older version is still in the apache /bin directory. Do I simply replace the openssl executable or is there some kind of change that needs to be made in the httpd.conf file to point to the newer installation?

+1 vote
custom openssl engine on apache using mod_ssl

My custom openssl engine works fine, tested it many times. I wanted to test it using mod_ssl, but needed a patch to enable dynamic engine support.
Now the problem is, I get a segmentation fault, whenever rsa methods in my custom openssl engine is called. I am using apache 2.4, and openssl 0.9.8e. Has anyone experienced it before?

+1 vote
Upgrading from OpenSSL 0.9.8 to OpenSSL 1.0.2a

I need to enable TLS 1.2 but since I currently have Apache 2.2.25 w/OpenSSL 0.9.8 installed, I can't do that. So, I left Apache 2.2.25 in place, installed OpenSSL 1.0.2a, and created the new openssl.cnf environment variables. The install was successful, the correct version is showing, but TLS 1.2 is still not enabled.

Any ideas on what I am missing?

+2 votes
Apache: Problems with proxy balancer in apache 2.2.22

Im trying to configure the proxy_balancer, but still having problems. Here is my configuration: 

BalancerMember http://172.16.14.81:80 
retry=120 
timeout=10 

BalancerMember http://172.16.14.82:80 
retry=1 
timeout=10 
status=+H

But when The first worker fails, request are not redirected to the failover worker. For this I have to wait for more than 7 minutes. Is this behavior normal?

...